-30- 



WHAT IS CLAIMED IS: 

1. A method for determining whether a client is attempting to 
copy an application or use the application without authorization, the method 
comprising: 

creating data for at least one prediction log file for the application; 

based on said at least one prediction log file, determining prediction 
knowledge for the application, wherein said prediction knowledge is stored in 
a prediction file; 

forwarding said prediction file to the client executing the application; 

and 

using said prediction file to determine whether the client is attempting 
to copy the application or use the application without authorization. 

2. The method of claim 1, further comprising: 

if it is determined that the client is attempting to access the application 
without authorization, then terminating the client's access to the application. 

3. The method of claim I, wherein the step of creating is 
comprised of the following: 

merging block IDs; 
creating short term strings; 
deleting triggers; 
creating long term strings; 

sorting said short term strings and said long term strings; and 
creating the triggers scheme data structure to create said at least one 
prediction log file. 

4. The method of claim 3, wherein the step of merging block IDs 
is comprised of the following: 

gathering at least one record in a connection table, wherein said at least 
one record has a first ID key and an second ID key; 
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sorting said gathered records by said second ID key, wherein said 
second ID key in said sorted records is sorted by average distance ascending; 
and 

merging said gathered records with said first ID key and said second 
ID key with records with said second ID key and a third ID key to create 
records with said first ID key and said third ID key. 

5. The method of claim 1, wherein the step of using said 
prediction file is comprised of the following: 

using said prediction file to determine pairs of block IDs that are most 
likely to be accessed together, wherein said pairs of block IDs has a first ED 
block and a second ID block; 

when the client accesses said first ID block, then starting a counter of 
D block requests; and 

after D block requests if the client has not accessed said second ID 
block, then indicating that the client is attempting to copy the application or 
use the application without authorization. 

6. A system for determining whether a client is attempting to copy 
an application or use the application without authorization, the method 
comprising: 

means for creating data for at least one prediction log file for the 
application; 

based on said at least one prediction log file, means for determining 
prediction knowledge for the application, wherein said prediction knowledge 
is stored in a prediction file; 

means for forwarding said prediction file to the client executing the 
application; and 

means for using said prediction file to determine whether the client is 
attempting to copy the application or use the application without authorization. 
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7. The system of claim 6, further comprising: 

means for terminating the client's access to the application if it is 
determined that the client is attempting to access the application without 
authorization. 

8. The system of claim 6, wherein the means for creating is 
comprised of the following: 

means for merging block IDs; 
means for creating short term strings; 
means for deleting triggers; 
means for creating long term strings; 

means for sorting said short term strings and said long term strings; 

and 

means for creating the triggers scheme data structure to create said at 
least one prediction log file. 

9. The system of claim 8, wherein the means for merging block 
IDs is comprised of the following: 

means for gathering at least one record in a connection table, wherein 
said at least one record has a first ID key and an second ID key; 

means for sorting said gathered records by said second ED key, wherein 
said second ID key in said sorted records is sorted by average distance 
ascending; and 

means for merging said gathered records with said first ID key and said 
second ID key with records with said second ID key and a third ID key to 
create records with said first ID key and said third ED key. 

10. The system of claim 6, wherein the means for using said 
prediction file is comprised of the following: 



SKGF Ref: 2193.0090000 



-33- 



means for using said prediction file to determine pairs of block IDs that 
are most likely to be accessed together, wherein said pairs of block IDs has a 
first ID block and a second ID block; 

means for starting a counter of D block requests when the client 
accesses said first ID block; and 

means for indicating that the client is attempting to copy the 
application or use the application without authorization after D block requests 
if the client has not accessed said second ID block. 
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